From de230f2f7050de4776641c1b9ce478153b74a1d0 Mon Sep 17 00:00:00 2001
From: Danila Poyarkov <dev@dannote.net>
Date: Wed, 1 Jul 2026 20:52:36 +0300
Subject: [PATCH] ci: deploy web only on releases or manually

---
 .github/workflows/app.yml  | 9 +++------
 .github/workflows/docs.yml | 7 +++----
 AGENTS.md                  | 5 ++++-
 3 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/app.yml b/.github/workflows/app.yml
index b00eedae6..9511286a1 100644
--- a/.github/workflows/app.yml
+++ b/.github/workflows/app.yml
@@ -2,11 +2,8 @@ name: Deploy app
 
 on:
   push:
-    branches: [master]
-    paths-ignore:
-      - 'packages/docs/**'
-      - 'openspec/**'
-      - '*.md'
+    tags:
+      - "v*"
   workflow_dispatch:
 
 jobs:
@@ -29,4 +26,4 @@ jobs:
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          command: pages deploy dist --project-name=openpencil-app
+          command: pages deploy dist --project-name=openpencil-app --branch=master
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 9913724ff..fb0ba70bd 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -2,9 +2,8 @@ name: Deploy docs
 
 on:
   push:
-    branches: [master]
-    paths:
-      - 'packages/docs/**'
+    tags:
+      - "v*"
   workflow_dispatch:
 
 jobs:
@@ -24,4 +23,4 @@ jobs:
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          command: pages deploy packages/docs/.vitepress/dist --project-name=openpencil-docs
+          command: pages deploy packages/docs/.vitepress/dist --project-name=openpencil-docs --branch=master
diff --git a/AGENTS.md b/AGENTS.md
index a39785e09..44598d0e8 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -72,12 +72,15 @@ The app editor session (`src/app/editor/session/create.ts`) is a Vue wrapper aro
    - Builds Tauri binaries for macOS (arm64 + x64), Windows (x64 + arm64), Linux (x64)
    - Creates a draft GitHub Release with all platform binaries
    - Publishes public workspace packages to npm with provenance. Keep the exact package list in sync with `.github/workflows/build.yml`.
-7. Go to GitHub Releases → edit the draft → paste changelog section → publish
+7. The production web app/docs deploy workflows (`app.yml`, `docs.yml`) also trigger on `v*` tags. They do **not** deploy on ordinary `master` pushes.
+8. Go to GitHub Releases → edit the draft → paste changelog section → publish
 
 ### CI workflows
 
 Key workflows live in `.github/workflows/`. Use `build.yml` as the source of truth for release packaging and npm publishing, `ci.yml` / `heavy-tests.yml` for validation gates, and `app.yml` / `docs.yml` for Cloudflare Pages deploys.
 
+Production Cloudflare Pages deploys are intentionally release/manual only: `app.yml` and `docs.yml` run on `v*` tags and `workflow_dispatch`, not on `master` pushes. To deploy manually, run the relevant workflow from GitHub Actions (`Deploy app` or `Deploy docs`) on the desired ref; the workflow deploys to the configured production branch (`master`).
+
 ## Documentation
 
 - `CHANGELOG.md` — all user-facing changes, grouped by version. "Unreleased" section at top for in-progress work.